Singapore’s Ahsay Backup Issues Comprehensive Patch After AhsayCBS Flaws Fueled Web‑Shell and Crypto‑Miner Attacks

Singapore‑based Ahsay Backup has published a set of security updates that close two high‑risk vulnerabilities in its AhsayCBS backup platform, which were recently weaponised by threat actors to install web shells and XMRig cryptocurrency miners on compromised servers.

The flaws, catalogued as CVE‑2026‑105133 and CVE‑2026‑105134, stem from insufficient input validation in the web interface of AhsayCBS. Exploitation allows an unauthenticated attacker to upload malicious scripts, effectively gaining remote code execution and the ability to run arbitrary binaries on the affected system.

Security researchers observed the vulnerabilities being abused in the wild within weeks of their discovery. Attackers leveraged the web‑shell capability to establish persistent footholds, then deployed XMRig miners to harvest Monero, a privacy‑focused cryptocurrency. Organizations using AhsayCBS reported unexpected spikes in CPU usage and unexplained outbound traffic, hallmarks of illicit mining operations.

Initial patches released by Ahsay Backup addressed parts of the problem but left a residual attack surface, prompting continued exploitation. The latest update, rolled out this week, fully remediates both CVE entries and includes additional hardening measures for the web management console.

Ahsay’s security team has urged all customers to apply the new patches immediately and to review system logs for signs of prior compromise. The company also recommends rotating credentials, disabling unnecessary services, and conducting a thorough inventory of any files introduced by the web shells.

The incident underscores a broader trend: backup and recovery solutions are increasingly targeted because they often sit at the nexus of critical data and network access. Prompt patch management, routine vulnerability scanning, and network segmentation remain essential defenses against such supply‑chain‑adjacent threats.

Looking ahead, Ahsay Backup says it will continue to monitor emerging threats and plans to release further hardening guidance in the coming months. Industry observers note that the rapid response, while belated, reflects growing pressure on software vendors to prioritize security in products that safeguard enterprise data.